The vulnerability arises from ASP.NET Core's inconsistent handling of certain HTTP requests, leading to a request/response smuggling flaw. An attacker without authorization can manipulate the sequence of requests and responses that the server processes, effectively tampering with data sent over the network. This can allow unauthorized alterations to traffic, potentially compromising authentication tokens, session data, or other sensitive information, and introducing the risk of further attacks such as session hijacking.

Affected products include Microsoft ASP.NET Core versions 8.0, 9.0, 10.0, and 11.0. The vulnerability also impacts Visual Studio 2022 17.14 and Visual Studio 2026 18.10, which ship with the affected ASP.NET Core runtimes or SDKs. The CVE list notes these specific versions as vulnerable; any deployment of these product versions should be examined.

With a CVSS score of 9.4, the flaw is considered critical. No EPSS score is available at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, where a network attacker sends crafted HTTP traffic to a target ASP.NET Core application, exploiting the smuggling issue to alter legitimate requests or responses. Because the flaw allows an attacker to modify traffic without authentication, the risk is high for confidentiality and integrity violations in exposed services.